jaffacakes118_Trojan-Ransom[.]Win32[.]Zerber[.]ctai[.]5376187e8085dd4788c00af5d43a51ad

resource
jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.5376187e8085dd4788c00af5d43a51ad
unpack001/$PLUGINSDIR/System.dll
unpack001/wainscottings.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.5376187e8085dd4788c00af5d43a51ad

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 50fbeab408c14702445bca1dada8f5e12b841a8b3fd621f02f499be638cd3d18
MD5 5376187e8085dd4788c00af5d43a51ad
SHA1 16cf36ec16663b04c9a6061487c202c76e1bf0e3
SHA512 84d51b403f3be1de59172eed1fd557d10e40fa3212aa4ebae389879934b5fe97e264d2e5eac3de6a07785fea182edd2e0bffedc8866f7961315f553975e02f87
SSDEEP 6144:Z92OYjxiPbuOrUYRCvDraMwR6TfacaowzgcjOe/JHNc:PYwJDRC/+Kfaca7zgcjOe1W
TLSH
T1ED542227A7E181DFEC9544724FFA7EB9DF3D0A0157A2994783011EBF68418E781062EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b
MD5 b8992e497d57001ddf100f9c397fcef5
SHA1 e26ddf101a2ec5027975d2909306457c6f61cfbd
SHA512 8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c
SSDEEP 192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
TLSH
T19A325C15135046F3E1D2853C142B3AAB6FB869118AF04E43CFB36852EF386C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

8168C_manual_install.txt

SHA256 3cda6289d1ac81962c04476f854f8e9743b92dbaafc057cbc606efc947ca299c
MD5 412319f5851cdda3f945eb465b32ea48
SHA1 c97f95204ef2fa6ae73f234511769a0f63cfce73
SHA512 b6bb9a9e5e7db544a377080fe11d6ce6a62ee866e84ced4996faafd2d65ebc21b17e70ef3714b2f3077b5a9a6d2e0c20c9834c4a72aa6ac8da7ec1c9c8ef5f8f
TLSH
T1CA1189184E104A34C5B3C3E71C8B258BFB2A86A6222F0A9E707F510C4C5B80CD2DD1C6
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Phonophore.oA

SHA256 6fe878be5a78878629918d88ddbf84f749f1a539ba39f68abeb60e0546eab451
MD5 0eddc0100ef9385aa7184de2e12106dd
SHA1 ba2df0754e2cc6c3698bdf2af2257c651952334d
SHA512 32d44fa303fe933443ed6d273deace75d090eaefe79eb93072ea74752a88c9101b3b39d1712f55cb491d03482d29c9c85cd8c90937d79a4d371ff8afe8b6a210
SSDEEP 3072:rXRlsWOa+A/yb/mOrumwR65nCaqjfS52r8d3MEnRZb8wG4F67BEc/M120MtuFhN:rjxiPbuOrUYRCvDraMwR6Tfacao+
TLSH
T13A041289DBE047857CE8284FCECC7CB9DC784A449FE5969A801550F7E08FCF391516A9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

bg.txt

SHA256 4dcabcc8ab8069db79143e4c62b6b76d2cf42666a09389eacfc35074b61779e3
MD5 833afb4f88fdb5f48245c9b65577dc19
SHA1 1a6e013226be42cd2d2872b1e6e5747fab65fe8a
SHA512 05bbc7abcfd0a0b7c3305c860b6372871cf3927bbe1790351485a315166e4cbdf8d38d63e01b677bdba251ce52da655f20b2d44b997d116a1794c7b3eb61ef31
SSDEEP 384:i6jWFsfLEnlztmkbjX8jD5VqWMTlHdr8vwyFSH:tfghGufHdrLyFA
TLSH
T113521371275A74DB1101F96F9C097E093CE645FE7FE7930245612DAC32F21B88AB924E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

gpl.txt

SHA256 0b383d5a63da644f628d99c33976ea6487ed89aaa59f0b3257992deac1171e6b
MD5 3c34afdc3adf82d2448f12715a255122
SHA1 7713a1753ce88f2c7e6b054ecc8e4c786df76300
SHA512 4937848b94f5b50ea16c51f9e98fdcd3953aca63d63ca3bb05d8a62c107e382b71c496838d130ae504a52032398630b957acaea6c48032081a6366d27cba5ea9
SSDEEP 768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
TLSH
T142F2825EB74513B205A202526E4FA8DEE31DD07A376A00657869C15C23B7E3483BFBAD
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

ko.txt

SHA256 5241a5c706960fa183f591434a0d7eebf21f569d2cf12f4fc783d0146800056b
MD5 fb25f8f6087eb8465afab4344fe2563a
SHA1 391c9335e0ac7988ce3722ccd96a1e401aeee335
SHA512 a497a70acbb8c3eabaa6f8c8d3671f3050ff2136e4f7d68d832d13cc3a1bc480bc385bd94565c125eb52285cbb4a935d308d4f9c14d40dbcbfb9b59fae442b27
SSDEEP 192:i36sSE/u96F/JVLsMsdSnBljdM98iQ0iK8Kn9Ws3I3q9FGcUBy6:iVSE/u96hnLsWBljmf9ilK9Ws8AGcqy6
TLSH
T16512B6B2A9D312D43597885A1CFAF495C9C16AD32BE71178BEC04F2DC911887098F9F3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

ro.txt

SHA256 f168bb4d026782134cc6c261006b815850e753a27fb47c4f23ee617666459a66
MD5 e3ee837f02a1f6e4b2213eb36c025284
SHA1 56ccafa0f9c3d805a845311c2ebd80c93a595b17
SHA512 a923f953af5df72e04b5c38e523a003b85c0ed74e20ae1c3a2d4848828e03de8e703953cfcf653c148a0eeaa9365f9187804de0d534435ccb90dac1c4ea68a63
SSDEEP 192:iVF8khF2yUYtHwfajHwKlPVS6LWbsWGGqZfG7ORVCPF27l:iD8mUYtHCxuPjWQu6KP0x
TLSH
T18AF1625BE4DDC9D32DC209CEB6B065A3C9CF40597EAFB11D62898EDE60C00718BA65C7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

ru.txt

SHA256 81b8d05ab12476a07bc868b0e3524a91bbc14dc58f14cfa4b6492e4238a6eb97
MD5 405de363e39ced9389b13e756a2f1242
SHA1 55389e88f7bbcdb3c56a110c73f5bef91b225de5
SHA512 21504e6f698d212cbe2253a7bf4d401e8367b698f6319163d53fe78bce38e94c1a466abfc3ad52ba9e26595fe41a3cc4f847800552204e0acb7a92d04e707c19
SSDEEP 192:ic2LUMKClXfitECTGV0jxOfXYCjisdvyMpf5ZOO8gCS4nY5tbV67wyxZ+XU2WtWg:igptEGntQYpY6MXsO7ChKeZ+HW0k
TLSH
T1E2622360365A74EF2102F91FD9086E097CAB45FD3FEE231618642E7E31F3564CA6D21A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

wainscottings.dll

IMPHASH 8e40b1022bdaa133af72873cbbb5a1dc
SHA256 7addc46bee320488022fd95dc2b9008fc43b8489fd868a5aa94c6640074dbac3
MD5 2e6607bf2a5f71df7f051764cc006ee8
SHA1 159abcb3ca839ba9113eb6de51fb8d3ee7d93ce2
SHA512 65ef1f21598534c5f5c8af4cb4c8e1cbb77b41c2e08d4923a6b25822a31971b43b0b428e225cbf4f7fd50ccafea3bedb12e5f07f4bb9ca2d1d7520af5eea957d
SSDEEP 1536:gAK+13zMziqsS422XtQvKoJHWoXETJ1MH6wbAV6M1jBPtp09Om8:gozMziY422XqzEJ1W9X
TLSH
T116A32A52B5D9C073F6050D7C846763D20A3FB87BAFA5F6832644119E9D323C25B7A38A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

38167

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

GetLastInputInfo IsChild LoadCursorA CreateMDIWindowW

advapi32

CryptContextAddRef

shell32

Shell_NotifyIconA

ole32

CoGetObject CoSwitchCallContext

kernel32

FreeEnvironmentStringsW HeapSize LCMapStringW LCMapStringA GetStringTypeW VerifyVersionInfoA SetCommBreak GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeA MultiByteToWideChar

jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.5376187e8085dd4788c00af5d43a51ad

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

8168C_manual_install.txt

Phonophore.oA

bg.txt

gpl.txt

ko.txt

ro.txt

ru.txt

wainscottings.dll

user32

advapi32

shell32

ole32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.5376187e8085dd4788c00af5d43a51ad

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

8168C_manual_install.txt

Phonophore.oA

bg.txt

gpl.txt

ko.txt

ro.txt

ru.txt

wainscottings.dll

user32

advapi32

shell32

ole32

kernel32

generic